Skip to content

Commit

Permalink
.Net: Fix vulnerabilities (#9733)
Browse files Browse the repository at this point in the history 
### Motivation and Context

- Fixes #9732
  • Loading branch information
@RogerBarreto
RogerBarreto authored Nov 18, 2024
1 parent d63de90 commit 5c998f2
Show file tree
Hide file tree
Showing 17 changed files with 60 additions and 11 deletions.
10 changes: 9 additions & 1 deletion dotnet/Directory.Packages.props
View file
Original file line number Diff line number Diff line change
Expand Up @@ -14,8 +14,11 @@
<PackageVersion Include="Dapr.AspNetCore" Version="1.14.0" />
<PackageVersion Include="Microsoft.AspNetCore.Mvc.Testing" Version="8.0.0" />
<PackageVersion Include="Microsoft.Extensions.Configuration.Abstractions" Version="8.0.0" />
<PackageVersion Include="Microsoft.IdentityModel.JsonWebTokens" Version="6.34.0" />
<PackageVersion Include="Microsoft.VisualStudio.Threading" Version="17.11.20" />
<PackageVersion Include="MSTest.TestFramework" Version="3.6.1" />
<PackageVersion Include="Newtonsoft.Json" Version="13.0.3" />
<PackageVersion Include="Npgsql" Version="8.0.5" />
<PackageVersion Include="OpenAI" Version="[2.1.0-beta.2]" />
<PackageVersion Include="Azure.AI.ContentSafety" Version="1.0.0" />
<PackageVersion Include="Azure.AI.OpenAI" Version="[2.1.0-beta.2]" />
Expand All @@ -38,14 +41,18 @@
<PackageVersion Include="Microsoft.CodeAnalysis.Common" Version="4.3.0" />
<PackageVersion Include="Microsoft.CodeAnalysis.CSharp" Version="4.3.0" />
<PackageVersion Include="Microsoft.Bcl.TimeProvider" Version="8.0.1" />
<PackageVersion Include="Microsoft.Identity.Client" Version="4.66.1" />
<PackageVersion Include="Microsoft.Identity.Client" Version="4.66.2" />
<PackageVersion Include="Microsoft.ML.OnnxRuntime" Version="1.19.2" />
<PackageVersion Include="FastBertTokenizer" Version="1.0.28" />
<PackageVersion Include="PdfPig" Version="0.1.9" />
<PackageVersion Include="Pinecone.NET" Version="2.1.1" />
<PackageVersion Include="System.Diagnostics.DiagnosticSource" Version="8.0.1" />
<PackageVersion Include="System.Formats.Asn1" Version="8.0.1" />
<PackageVersion Include="System.IdentityModel.Tokens.Jwt" Version="6.34.0" />
<PackageVersion Include="System.IO.Packaging" Version="8.0.1" />
<PackageVersion Include="System.Linq.Async" Version="6.0.1" />
<PackageVersion Include="System.Memory.Data" Version="8.0.1" />
<PackageVersion Include="System.Net.Http" Version="4.3.4" />
<PackageVersion Include="System.Numerics.Tensors" Version="8.0.0" />
<PackageVersion Include="System.Text.Json" Version="8.0.5" />
<PackageVersion Include="OllamaSharp" Version="4.0.6" />
Expand Down Expand Up @@ -78,6 +85,7 @@
<!-- Test -->
<PackageVersion Include="Microsoft.NET.Test.Sdk" Version="17.11.1" />
<PackageVersion Include="Moq" Version="[4.18.4]" />
<PackageVersion Include="System.Text.RegularExpressions" Version="4.3.1" />
<PackageVersion Include="System.Threading.Channels" Version="8.0.0" />
<PackageVersion Include="System.Threading.Tasks.Dataflow" Version="8.0.0" />
<PackageVersion Include="Verify.Xunit" Version="23.5.2" />
Expand Down
23 changes: 22 additions & 1 deletion dotnet/SK-dotnet.sln
View file
Original file line number Diff line number Diff line change
Expand Up @@ -426,6 +426,12 @@ Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "OllamaFunctionCalling", "sa
EndProject
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "OpenAIRealtime", "samples\Demos\OpenAIRealtime\OpenAIRealtime.csproj", "{6154129E-7A35-44A5-998E-B7001B5EDE14}"
EndProject
Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "CreateChatGpt", "CreateChatGpt", "{02EA681E-C7D8-13C7-8484-4AC65E1B71E8}"
EndProject
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "sk-chatgpt-azure-function", "samples\Demos\CreateChatGptPlugin\MathPlugin\azure-function\sk-chatgpt-azure-function.csproj", "{2EB6E4C2-606D-B638-2E08-49EA2061C428}"
EndProject
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "kernel-functions-generator", "samples\Demos\CreateChatGptPlugin\MathPlugin\kernel-functions-generator\kernel-functions-generator.csproj", "{78785CB1-66CF-4895-D7E5-A440DD84BE86}"
EndProject
Global
GlobalSection(SolutionConfigurationPlatforms) = preSolution
Debug|Any CPU = Debug|Any CPU
Expand Down Expand Up @@ -1141,6 +1147,18 @@ Global
{6154129E-7A35-44A5-998E-B7001B5EDE14}.Publish|Any CPU.Build.0 = Debug|Any CPU
{6154129E-7A35-44A5-998E-B7001B5EDE14}.Release|Any CPU.ActiveCfg = Release|Any CPU
{6154129E-7A35-44A5-998E-B7001B5EDE14}.Release|Any CPU.Build.0 = Release|Any CPU
{2EB6E4C2-606D-B638-2E08-49EA2061C428}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
{2EB6E4C2-606D-B638-2E08-49EA2061C428}.Debug|Any CPU.Build.0 = Debug|Any CPU
{2EB6E4C2-606D-B638-2E08-49EA2061C428}.Publish|Any CPU.ActiveCfg = Debug|Any CPU
{2EB6E4C2-606D-B638-2E08-49EA2061C428}.Publish|Any CPU.Build.0 = Debug|Any CPU
{2EB6E4C2-606D-B638-2E08-49EA2061C428}.Release|Any CPU.ActiveCfg = Release|Any CPU
{2EB6E4C2-606D-B638-2E08-49EA2061C428}.Release|Any CPU.Build.0 = Release|Any CPU
{78785CB1-66CF-4895-D7E5-A440DD84BE86}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
{78785CB1-66CF-4895-D7E5-A440DD84BE86}.Debug|Any CPU.Build.0 = Debug|Any CPU
{78785CB1-66CF-4895-D7E5-A440DD84BE86}.Publish|Any CPU.ActiveCfg = Debug|Any CPU
{78785CB1-66CF-4895-D7E5-A440DD84BE86}.Publish|Any CPU.Build.0 = Debug|Any CPU
{78785CB1-66CF-4895-D7E5-A440DD84BE86}.Release|Any CPU.ActiveCfg = Release|Any CPU
{78785CB1-66CF-4895-D7E5-A440DD84BE86}.Release|Any CPU.Build.0 = Release|Any CPU
EndGlobalSection
GlobalSection(SolutionProperties) = preSolution
HideSolutionNode = FALSE
Expand Down Expand Up @@ -1227,7 +1245,7 @@ Global
{644A2F10-324D-429E-A1A3-887EAE64207F} = {6823CD5E-2ABE-41EB-B865-F86EC13F0CF9}
{5D4C0700-BBB5-418F-A7B2-F392B9A18263} = {FA3720F1-C99A-49B2-9577-A940257098BF}
{B04C26BC-A933-4A53-BE17-7875EB12E012} = {FA3720F1-C99A-49B2-9577-A940257098BF}
{E6204E79-EFBF-499E-9743-85199310A455} = {5D4C0700-BBB5-418F-A7B2-F392B9A18263}
{E6204E79-EFBF-499E-9743-85199310A455} = {02EA681E-C7D8-13C7-8484-4AC65E1B71E8}
{CBEEF941-AEC6-42A4-A567-B5641CEFBB87} = {5D4C0700-BBB5-418F-A7B2-F392B9A18263}
{E12E15F2-6819-46EA-8892-73E3D60BE76F} = {5D4C0700-BBB5-418F-A7B2-F392B9A18263}
{5C813F83-9FD8-462A-9B38-865CA01C384C} = {5D4C0700-BBB5-418F-A7B2-F392B9A18263}
Expand Down Expand Up @@ -1297,6 +1315,9 @@ Global
{B35B1DEB-04DF-4141-9163-01031B22C5D1} = {0D8C6358-5DAA-4EA6-A924-C268A9A21BC9}
{481A680F-476A-4627-83DE-2F56C484525E} = {5D4C0700-BBB5-418F-A7B2-F392B9A18263}
{6154129E-7A35-44A5-998E-B7001B5EDE14} = {5D4C0700-BBB5-418F-A7B2-F392B9A18263}
{02EA681E-C7D8-13C7-8484-4AC65E1B71E8} = {5D4C0700-BBB5-418F-A7B2-F392B9A18263}
{2EB6E4C2-606D-B638-2E08-49EA2061C428} = {02EA681E-C7D8-13C7-8484-4AC65E1B71E8}
{78785CB1-66CF-4895-D7E5-A440DD84BE86} = {02EA681E-C7D8-13C7-8484-4AC65E1B71E8}
EndGlobalSection
GlobalSection(ExtensibilityGlobals) = postSolution
SolutionGuid = {FBDC56A3-86AD-4323-AA0F-201E59123B83}
Expand Down
9 changes: 9 additions & 0 deletions dotnet/nuget/nuget-package.props
View file
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,15 @@
<!-- Do not validate reference assemblies -->
<NoWarn>$(NoWarn);CP1002</NoWarn>

<!-- Enable NuGet package auditing -->
<NuGetAudit>true</NuGetAudit>

<!-- Audit direct and transitive packages -->
<NuGetAuditMode>all</NuGetAuditMode>

<!-- Report low, moderate, high and critical advisories -->
<NuGetAuditLevel>low</NuGetAuditLevel>

<!-- Default description and tags. Packages can override. -->
<Authors>Microsoft</Authors>
<Company>Microsoft</Company>
Expand Down
1 change: 1 addition & 0 deletions dotnet/samples/Concepts/Concepts.csproj
View file
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,7 @@
<ItemGroup>
<PackageReference Include="Docker.DotNet" />
<PackageReference Include="Microsoft.NET.Test.Sdk" />
<PackageReference Include="Npgsql" />
<PackageReference Include="xRetry" />
<PackageReference Include="xunit" />
<PackageReference Include="xunit.abstractions" />
Expand Down
2 changes: 1 addition & 1 deletion dotnet/samples/Concepts/Planners/AutoFunctionCallingPlanning.cs
View file
Original file line number Diff line number Diff line change
Expand Up @@ -291,7 +291,7 @@ private static string GetCacheKey(ChatHistory chatHistory)

byte[] bytes = SHA256.HashData(Encoding.UTF8.GetBytes(goal));

return BitConverter.ToString(bytes).Replace("-", "").ToUpperInvariant();
return Convert.ToHexString(bytes).Replace("-", "").ToUpperInvariant();
}
}

Expand Down
2 changes: 2 additions & 0 deletions ...ples/Demos/CreateChatGptPlugin/MathPlugin/azure-function/sk-chatgpt-azure-function.csproj
View file
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,8 @@
<PackageReference Include="Microsoft.Azure.Functions.Worker" />
<PackageReference Include="Microsoft.Azure.Functions.Worker.Extensions.Http" />
<PackageReference Include="Microsoft.Azure.WebJobs.Extensions.OpenApi" />
<PackageReference Include="System.Net.Http" />
<PackageReference Include="System.Text.RegularExpressions" />
</ItemGroup>

<ItemGroup>
Expand Down
3 changes: 2 additions & 1 deletion ...nnectors/Connectors.Memory.AzureCosmosDBNoSQL/Connectors.Memory.AzureCosmosDBNoSQL.csproj
View file
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,8 @@
</PropertyGroup>

<ItemGroup>
<PackageReference Include="Microsoft.Azure.Cosmos"/>
<PackageReference Include="Microsoft.Azure.Cosmos" />
<PackageReference Include="Newtonsoft.Json" />
</ItemGroup>

<ItemGroup>
Expand Down
1 change: 1 addition & 0 deletions dotnet/src/Connectors/Connectors.Memory.Kusto/Connectors.Memory.Kusto.csproj
View file
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,7 @@

<ItemGroup>
<PackageReference Include="Microsoft.Azure.Kusto.Data" />
<PackageReference Include="System.Formats.Asn1" />
</ItemGroup>

<ItemGroup>
Expand Down
4 changes: 1 addition & 3 deletions dotnet/src/Connectors/Connectors.Memory.Postgres/AssemblyInfo.cs
View file
Original file line number Diff line number Diff line change
@@ -1,6 +1,4 @@
// Copyright (c) Microsoft. All rights reserved.

using System.Diagnostics.CodeAnalysis;

// This assembly is currently experimental.
[assembly: Experimental("SKEXP0020")]
[assembly: System.Diagnostics.CodeAnalysis.Experimental("SKEXP0020")]
2 changes: 2 additions & 0 deletions dotnet/src/Connectors/Connectors.Memory.Postgres/Connectors.Memory.Postgres.csproj
View file
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,7 @@
<RootNamespace>$(AssemblyName)</RootNamespace>
<TargetFrameworks>net8.0;netstandard2.0</TargetFrameworks>
<VersionSuffix>alpha</VersionSuffix>
<NoWarn>$(NoWarn);CS0436</NoWarn>
</PropertyGroup>

<!-- IMPORT NUGET PACKAGE SHARED PROPERTIES -->
Expand All @@ -20,6 +21,7 @@

<ItemGroup>
<PackageReference Include="Microsoft.Bcl.AsyncInterfaces" />
<PackageReference Include="Npgsql" />
<PackageReference Include="Pgvector" />
</ItemGroup>

Expand Down
2 changes: 1 addition & 1 deletion dotnet/src/Connectors/Connectors.MistralAI/Client/MistralClient.cs
View file
Original file line number Diff line number Diff line change
Expand Up @@ -566,7 +566,7 @@ internal async Task<IList<ReadOnlyMemory<float>>> GenerateEmbeddingsAsync(IList<

var response = await this.SendRequestAsync<TextEmbeddingResponse>(httpRequestMessage, cancellationToken).ConfigureAwait(false);

return response.Data!.Select(item => new ReadOnlyMemory<float>([.. item.Embedding])).ToList();
return response.Data!.Select(item => new ReadOnlyMemory<float>([.. item.Embedding!])).ToList();
}

#region private
Expand Down
1 change: 1 addition & 0 deletions dotnet/src/Connectors/Connectors.UnitTests/Connectors.UnitTests.csproj
View file
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,7 @@
<ItemGroup>
<PackageReference Include="Microsoft.NET.Test.Sdk" />
<PackageReference Include="Moq" />
<PackageReference Include="Npgsql" />
<PackageReference Include="xunit" />
<PackageReference Include="xunit.runner.visualstudio">
<IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
Expand Down
1 change: 1 addition & 0 deletions dotnet/src/Functions/Functions.OpenApi/Functions.OpenApi.csproj
View file
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,7 @@
<InternalsVisibleTo Include="Microsoft.SemanticKernel.Plugins.OpenApi.Extensions" />
</ItemGroup>
<ItemGroup>
<PackageReference Include="Microsoft.Identity.Client" />
<PackageReference Include="Microsoft.Identity.Client.Extensions.Msal" />
<PackageReference Include="Microsoft.OpenApi" />
<PackageReference Include="Microsoft.OpenApi.Readers" />
Expand Down
1 change: 1 addition & 0 deletions dotnet/src/IntegrationTests/IntegrationTests.csproj
View file
Original file line number Diff line number Diff line change
Expand Up @@ -51,6 +51,7 @@
<PackageReference Include="Microsoft.Extensions.Http.Resilience" />
<PackageReference Include="Microsoft.Extensions.TimeProvider.Testing" />
<PackageReference Include="Microsoft.NET.Test.Sdk" />
<PackageReference Include="Npgsql" />
<PackageReference Include="Pinecone.NET" />
<PackageReference Include="System.Linq.Async" />
<PackageReference Include="xRetry" />
Expand Down
5 changes: 2 additions & 3 deletions dotnet/src/InternalUtilities/src/Diagnostics/ModelDiagnostics.cs
View file
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,6 @@
using System;
using System.Collections.Generic;
using System.Diagnostics;
using System.Diagnostics.CodeAnalysis;
using System.Linq;
using System.Text;
using System.Text.Json;
Expand All @@ -21,8 +20,8 @@ namespace Microsoft.SemanticKernel.Diagnostics;
/// `SEMANTICKERNEL_EXPERIMENTAL_GENAI_ENABLE_OTEL_DIAGNOSTICS`
/// `SEMANTICKERNEL_EXPERIMENTAL_GENAI_ENABLE_OTEL_DIAGNOSTICS_SENSITIVE`
/// </summary>
[Experimental("SKEXP0001")]
[ExcludeFromCodeCoverage]
[System.Diagnostics.CodeAnalysis.Experimental("SKEXP0001")]
[System.Diagnostics.CodeAnalysis.ExcludeFromCodeCoverage]
internal static class ModelDiagnostics
{
private static readonly string s_namespace = typeof(ModelDiagnostics).Namespace!;
Expand Down
1 change: 1 addition & 0 deletions dotnet/src/Plugins/Plugins.Document/Plugins.Document.csproj
View file
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,7 @@

<ItemGroup>
<PackageReference Include="DocumentFormat.OpenXml" />
<PackageReference Include="System.IO.Packaging" />
</ItemGroup>

<ItemGroup>
Expand Down
3 changes: 3 additions & 0 deletions dotnet/src/Plugins/Plugins.MsGraph/Plugins.MsGraph.csproj
View file
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,9 @@
<PackageReference Include="Microsoft.Extensions.Logging.Abstractions" />
<PackageReference Include="Microsoft.Graph" />
<PackageReference Include="Microsoft.Identity.Client.Extensions.Msal" />
<PackageReference Include="Microsoft.Identity.Client" />
<PackageReference Include="Microsoft.IdentityModel.JsonWebTokens" />
<PackageReference Include="System.IdentityModel.Tokens.Jwt" />
</ItemGroup>

<ItemGroup>
Expand Down

0 comments on commit 5c998f2

Please sign in to comment.